CyberStrike：面向进攻性安全的开源 AI 智能体框架（AGPL）

首个专为进攻性安全构建的开源 AI 智能体。

在终端中执行自动化渗透测试——接入你的 Claude、GPT 或任意 LLM 订阅，
即可将其转化为自主红队 Agent，配备 13 类以上专业 Agent、7,600 多项安全技能和 120 多个 OWASP 测试用例。
150 多家 AI 提供商 • 5,300 多个模型 • 56 多种内置工具 • 176 多种 MCP 工具

快速开始 • 智能层 • 核心差异 • Agents • 技能 • Web UI • Bolt • MCP 生态系统 • 后渗透 • 安装 • 文档 • 网站

---

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

就是这样。CyberStrike 会在终端中启动一个 TUI；首次运行时，它会询问你的 LLM 提供商和 API key，随后即可使用。只需告诉它要测试什么——它将自主处理侦察、漏洞发现、利用和报告。

已经拥有 Claude Code 或 OpenAI 订阅？ CyberStrike 的智能层构建于你现有的 AI 订阅之上。无需额外 API 成本——你当前的套餐即可为完整的渗透测试工具包提供支持。

请在 docs.cyberstrike.io 浏览完整文档，或访问 cyberstrike.io 查看演示和指南。

---

CyberStrike 不只是 LLM 的封装层，而是一个能将任何 AI 模型转化为进攻性安全专家的智能层。

工作原理： 当你连接 LLM 提供商时，CyberStrike 会在每次交互中注入特定领域的上下文，包括 OWASP 测试方法论、漏洞模式、攻击链推理以及工具编排逻辑。模型本身无需了解安全知识；CyberStrike 会教会它。

智能层提供：

• Schema 标准化——无论不同提供商的响应格式有何差异，均可获得结构化输出
• 上下文防护——防止提示词泄露，并让 Agent 聚焦于当前测试阶段
• 提供商自动识别——自动识别你的 LLM 端点，并配置最优传输方式
• 工具编排——依据发现结果而非固定脚本，智能串联安全工具

开箱即支持 150 多家 AI 提供商和 5,300 多个模型：

CyberStrike 通过 23 个内置 SDK 提供商，以及 models.dev 目录中的 150 多家提供商，集成了整个 AI 生态系统。以下为核心集成：

提供商	模型	说明
Anthropic	Claude 4.5、Claude 4	扩展思考模式下表现最佳
OpenAI	GPT-5、GPT-4.1、o3、o4	完整支持工具调用与推理
Google	Gemini 2.5 Pro/Flash	为大型代码库提供长上下文
Amazon Bedrock	全部 Bedrock 模型	IAM 认证，无需 API key
Azure OpenAI	全部 Azure 托管模型	面向企业部署
Google Vertex AI	GCP 上的 Gemini + Claude	区域端点（欧盟/美国）
GitHub Copilot	GPT-5、Claude、Gemini	使用你现有的 Copilot 订阅
xAI	Grok 3、Grok 3 Mini	实时数据访问
Groq	LLaMA、Mixtral	超高速推理
Mistral	Mistral Large、Codestral	欧洲数据驻留
DeepSeek	DeepSeek V3、R1	具成本效益的替代方案
Cerebras	Cerebras 上运行的 LLaMA	可用的最快推理
Cohere	Command R+	面向 RAG 优化的模型
OpenRouter	300 多个模型	一个 API，调用任意模型
Together AI	开源模型	支持微调
DeepInfra	开源模型	按 token 付费，无需 GPU
Perplexity	Sonar 模型	搜索增强生成
Alibaba Cloud	Qwen、Kimi、DashScope	中国模型生态系统
Cloudflare AI Gateway	通过网关使用任意提供商	缓存、限流、分析
Ollama	任意 GGUF 模型	完全离线，仅本地运行
LM Studio	任意本地模型	桌面 GUI + API 服务器
vLLM	任意 HuggingFace 模型	自托管，针对 GPU 优化
任何兼容 OpenAI 的服务	—	欢迎使用自定义端点

隔离网络环境？ 使用 Ollama 或 LM Studio 可完全离线运行 CyberStrike。数据绝不会离开你的机器。

---

专业安全 Agent，而非通用聊天工具 CyberStrike 内置 13 类以上专为安全领域设计的 Agent。每个 Agent 都具备特定领域的方法论、工具知识与测试模式。Web 应用 Agent 遵循 OWASP WSTG；云安全 Agent 熟悉 CIS 基准；移动端 Agent 使用 Frida 并遵循 MASTG/MASVS。它们不会猜测——而是遵循经验证的进攻性安全框架。	智能层，而不只是 LLM 封装器 大多数 AI 安全工具只是将你的提示词发送至 API 的薄封装。CyberStrike 的智能层可标准化 150 多家提供商和 5,300 多个模型的输出，在不同测试阶段之间保护上下文，自动识别你的提供商配置，并编排多步骤攻击链。结果是：无论使用哪种模型，都能获得一致的、方法论驱动的渗透测试。
150 多家提供商，零锁定 Anthropic、OpenAI、Google、Amazon Bedrock、Azure、Groq、Mistral、xAI、DeepSeek、Cerebras、Cohere、OpenRouter、Together AI、GitHub Copilot——或者通过 Ollama 和 LM Studio 完全离线运行。支持 150 多家提供商和 5,300 多个模型。你选择模型，你拥有结果。随着 AI 模型变得更强、更便宜，CyberStrike 也会随之提升。无需重新配置，即可在数秒内切换提供商。	通过 Bolt 执行远程工具 你的安全工具不必运行在笔记本电脑上。可在一台或多台远程服务器部署 Bolt，通过 Ed25519 密钥配对，并从本地终端控制一切。一个 CyberStrike 实例即可编排数十台 Bolt 服务器——每台均拥有自己的工具集、网络位置和攻击面访问权限。

---

使用 Tab 在 Agent 之间切换。每个 Agent 都是领域专家。

Agent	重点领域	功能
cyberstrike	通用	具备完整访问权限的主 Agent——侦察、利用、报告
web-application	Web	OWASP Top 10、WSTG 方法论、API 安全、会话测试
mobile-application	移动端	Android/iOS、Frida/Objection、MASTG/MASVS 合规性
cloud-security	云	AWS、Azure、GCP——IAM 配置错误、CIS 基准、暴露资源
internal-network	网络	Active Directory、Kerberos 攻击、横向移动、枢纽转移

此外还有 8 个专业代理测试器，会在被拦截的流量上自动运行：

测试器	测试内容
IDOR	对象级访问控制——用户 A 能否访问用户 B 的资源？
Authorization Bypass	垂直权限提升——低权限用户能否访问管理员端点？
Mass Assignment	意外可写字段——请求体中的角色、价格、余额、userId
Injection	覆盖所有输入向量的 SQL、命令、LDAP、模板注入
Authentication	Token 验证、会话固定、凭据泄露
Business Logic	价格操纵、优惠券复用、竞态条件、工作流绕过
SSRF	通过用户可控 URL 或重定向参数访问内部主机
File Attacks	路径遍历、不受限制的上传、危险文件类型

每个测试器均使用 3 道确认协议：执行基准请求、执行攻击、比较响应。只有在存在可测量、可复现的差异时，才会报告发现结果——而非基于推测。同一会话中，重复发现（相同端点 + 攻击向量）会被自动抑制。

---

CyberStrike 内置 7,600 多个安全技能文件——这些采用 Ed25519 签名的结构化方法论文档，可在运行时为 Agent 提供深度领域知识。技能采用惰性加载（按需一次加载一个），并被静态注入至 Agent 提示词中。

技能类别：

类别	技能数量	覆盖内容
攻击方法论	19	JWT 攻击、SSRF、SSTI、竞态条件、请求走私、缓存投毒、CORS、GraphQL、原型污染、XXE、WebSocket、子域名接管、Host Header 注入、开放重定向
后渗透	5	AWS、Azure、Kubernetes、Windows、macOS 的权限提升与持久化
合规框架	3	CIS 基准（AWS/Azure/GCP/K8s）、NIST 框架、MITRE ATT&CK（企业、移动端、ICS）
领域知识	8+	Active Directory 安全、Web 安全模式、侦察方法论、CI/CD 攻击、Kerberos 攻击、eBPF 技术

每项技能均包含测试流程、载荷、工具命令和 CWE 映射。技能带有 OWASP WSTG ID、CIS 控制 ID 及链式关系标签，因此 Agent 知道应如何组合技能来构建多步骤攻击链。

---

完整文档：docs.cyberstrike.io/docs/tools/hacker-browser

HackBrowser 是 CyberStrike 内置的 Chromium 浏览器。可通过 TUI 中的 /hackbrowser 启动它。浏览期间，每一条 HTTP 请求都会被捕获并通过代理 Agent 管道进行路由——无需手动导出，也无需 Burp 项目文件。

两种捕获模式：

• 手动——自行浏览目标。以不同用户身份登录、浏览功能、触发操作。HackBrowser 会捕获每次点击背后的真实 API 流量。
• 自主——为多个账户提供凭据、设置范围，然后让 HackBrowser 自动爬取。它会以每个用户身份登录，映射可访问页面，并捕获不同角色之间的流量差异。

角色与凭据发现：

当你使用多个账户浏览时，CyberStrike 会建立会话上下文——这是一份持续更新的地图，记录已发现的凭据、推断出的角色层级，以及每种角色可访问的端点。8 个代理子测试器会直接使用此上下文：无需手动设置，它们就知道应使用哪个 token 作为高权限基准，以及使用哪些低权限凭据进行测试。

浏览器流量 → 代理拦截 → 编排器 → 8 个子测试器（并行）
                                  ↓
                       会话上下文（凭据、角色、
                       端点、功能）在所有测试器间共享

范围控制：

使用 --scope 将测试限制在特定域名。CyberStrike 会自动推导注册域名（例如，--scope api.example.com 覆盖 api.example.com，但不覆盖 other.com）。对于多域名目标，可传入多个 --scope 标志。

---

CyberStrike 包含完整的 Web 界面。运行 cyberstrike web，即可控制你的 Agent、MCP 服务器、Bolt 连接和漏洞发现结果

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी

The first open-source AI agent built for offensive security.

Automated penetration testing from your terminal — plug in your Claude, GPT, or any LLM subscription
and turn it into an autonomous red team agent with 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases.
150+ AI providers • 5,300+ models • 56+ built-in tools • 176+ MCP tools

Quick Start • Intelligence Layer • What Makes It Different • Agents • Skills • Web UI • Bolt • MCP Ecosystem • Post-Exploitation • Installation • Docs • Website

---

npm i -g @cyberstrike-io/cyberstrike@latest && cyberstrike

That's it. CyberStrike launches a TUI in your terminal, asks for your LLM provider and API key on first run, and you're ready to go. Tell it what to test — it handles reconnaissance, vulnerability discovery, exploitation, and reporting autonomously.

Already have a Claude Code or OpenAI subscription? CyberStrike's intelligence layer sits on top of your existing AI subscription. No separate API costs — your current plan powers an entire pentest toolkit.

Explore the full documentation at docs.cyberstrike.io or visit cyberstrike.io for demos and guides.

---

CyberStrike isn't just a wrapper around an LLM. It's an intelligence layer that transforms any AI model into an offensive security specialist.

How it works: When you connect your LLM provider, CyberStrike injects domain-specific context — OWASP testing methodology, vulnerability patterns, attack chain reasoning, and tool orchestration logic — into every interaction. The model doesn't need to know security; CyberStrike teaches it.

What the intelligence layer provides:

• Schema normalization — Structured output from any provider, regardless of response format differences
• Context guard — Prevents prompt leakage and keeps the agent focused on the current test phase
• Provider auto-detection — Automatically identifies your LLM endpoint and configures the optimal transport
• Tool orchestration — Chains security tools intelligently based on findings, not fixed scripts

150+ AI providers and 5,300+ models supported out of the box:

CyberStrike integrates with the entire AI ecosystem through 23 bundled SDK providers and 150+ providers via the models.dev catalog. Here are the core integrations:

Provider	Models	Notes
Anthropic	Claude 4.5, Claude 4	Best performance with extended thinking
OpenAI	GPT-5, GPT-4.1, o3, o4	Full tool-use + reasoning support
Google	Gemini 2.5 Pro/Flash	Long context for large codebases
Amazon Bedrock	All Bedrock models	IAM auth, no API keys needed
Azure OpenAI	All Azure-hosted models	Enterprise deployments
Google Vertex AI	Gemini + Claude on GCP	Regional endpoints (EU/US)
GitHub Copilot	GPT-5, Claude, Gemini	Use your existing Copilot subscription
xAI	Grok 3, Grok 3 Mini	Real-time data access
Groq	LLaMA, Mixtral	Ultra-fast inference
Mistral	Mistral Large, Codestral	European data residency
DeepSeek	DeepSeek V3, R1	Cost-effective alternative
Cerebras	LLaMA on Cerebras	Fastest inference available
Cohere	Command R+	RAG-optimized models
OpenRouter	300+ models	Single API, any model
Together AI	Open-source models	Fine-tuning support
DeepInfra	Open-source models	Pay-per-token, no GPU needed
Perplexity	Sonar models	Search-augmented generation
Alibaba Cloud	Qwen, Kimi, DashScope	Chinese model ecosystem
Cloudflare AI Gateway	Any provider via gateway	Caching, rate limiting, analytics
Ollama	Any GGUF model	Fully offline, local-only
LM Studio	Any local model	Desktop GUI + API server
vLLM	Any HuggingFace model	Self-hosted, GPU-optimized
Any OpenAI-compatible	—	Custom endpoints welcome

Air-gapped environments? Run CyberStrike entirely offline with Ollama or LM Studio. No data leaves your machine — ever.

---

Specialized Security Agents, Not Generic Chat CyberStrike ships with 13+ agents purpose-built for security domains. Each agent carries domain-specific methodology, tool knowledge, and testing patterns. The web-application agent follows OWASP WSTG. The cloud-security agent knows CIS benchmarks. The mobile agent uses Frida and follows MASTG/MASVS. They don't guess — they follow proven offensive security frameworks.

Intelligence Layer, Not Just an LLM Wrapper Most AI security tools are thin wrappers that send your prompt to an API. CyberStrike's intelligence layer normalizes outputs across 150+ providers and 5,300+ models, guards context between test phases, auto-detects your provider configuration, and orchestrates multi-step attack chains. The result: consistent, methodology-driven pentesting regardless of which model you use.

150+ Providers, Zero Lock-in Anthropic, OpenAI, Google, Amazon Bedrock, Azure, Groq, Mistral, xAI, DeepSeek, Cerebras, Cohere, OpenRouter, Together AI, GitHub Copilot — or run fully offline with Ollama and LM Studio. 150+ providers, 5,300+ models. You choose the model. You own the results. As AI models get better and cheaper, CyberStrike gets better with them. Switch providers in seconds without reconfiguring anything.

Remote Tool Execution with Bolt Your security tools don't have to run on your laptop. Deploy Bolt on one or many remote servers, pair with Ed25519 keys, and control everything from your local terminal. One CyberStrike instance can orchestrate dozens of Bolt servers — each with its own toolkit, network position, and attack surface access.

---

Switch between agents with Tab. Each one is a domain specialist.

Agent	Focus	What It Does
cyberstrike	General	Full-access primary agent — reconnaissance, exploitation, reporting
web-application	Web	OWASP Top 10, WSTG methodology, API security, session testing
mobile-application	Mobile	Android/iOS, Frida/Objection, MASTG/MASVS compliance
cloud-security	Cloud	AWS, Azure, GCP — IAM misconfigs, CIS benchmarks, exposed resources
internal-network	Network	Active Directory, Kerberos attacks, lateral movement, pivoting

Plus 8 specialized proxy testers that run automatically on intercepted traffic:

Tester	What It Tests
IDOR	Object-level access control — can user A reach user B's resources?
Authorization Bypass	Vertical privilege escalation — can low-privilege users hit admin endpoints?
Mass Assignment	Unexpected writable fields — role, price, balance, userId in request bodies
Injection	SQL, command, LDAP, template injection across all input vectors
Authentication	Token validation, session fixation, credential exposure
Business Logic	Price manipulation, coupon reuse, race conditions, workflow bypass
SSRF	Internal host access via user-controlled URLs or redirect parameters
File Attacks	Path traversal, unrestricted upload, dangerous file types

Each tester uses a 3-gate confirmation protocol : execute a baseline request, execute the attack, compare responses. A finding is only reported when there is a measurable, reproducible difference — not on speculation. Duplicate findings (same endpoint + attack vector) are automatically suppressed across the session.

---

CyberStrike ships with 7,600+ security skill files — structured, Ed25519-signed methodology documents that give agents deep domain knowledge at runtime. Skills are lazy-loaded (one at a time, on demand) and statically injected into agent prompts.

Skill categories:

Category	Skills	What They Cover
Attack Methodologies	19	JWT attacks, SSRF, SSTI, race conditions, request smuggling, cache poisoning, CORS, GraphQL, prototype pollution, XXE, WebSocket, subdomain takeover, host header injection, open redirect
Post-Exploitation	5	AWS, Azure, Kubernetes, Windows, macOS privilege escalation and persistence
Compliance Frameworks	3	CIS Benchmarks (AWS/Azure/GCP/K8s), NIST Framework, MITRE ATT&CK (Enterprise, Mobile, ICS)
Domain Knowledge	8+	Active Directory security, web security patterns, recon methodology, CI/CD attacks, Kerberos attacks, eBPF techniques

Each skill includes testing procedures, payloads, tool commands, and CWE mappings. Skills are tagged with OWASP WSTG IDs, CIS control IDs, and chain relationships — so agents know which skills to combine for multi-step attack chains.

---

Full documentation: docs.cyberstrike.io/docs/tools/hacker-browser

HackBrowser is CyberStrike's built-in Chromium browser. Start it from the TUI with /hackbrowser. As you browse, every HTTP request is captured and routed through the proxy-agent pipeline — no manual export, no Burp project files.

Two capture modes:

• Manual — Browse the target yourself. Log in as different users, navigate features, trigger actions. HackBrowser captures the real API traffic behind every click.
• Autonomous — Provide credentials for multiple accounts, set a scope, and let HackBrowser crawl automatically. It logs in as each user, maps reachable pages, and captures the traffic difference between roles.

Role & credential discovery:

As you browse with multiple accounts, CyberStrike builds a session context — a live map of discovered credentials, inferred role hierarchy, and which endpoints each role can reach. The 8 proxy sub-testers use this context directly: they know which token to use for a high-privilege baseline and which lower-privilege credentials to test with, without any manual setup.

Browser traffic → Proxy intercept → Orchestrator → 8 sub-testers (parallel)
                                          ↓
                               Session context (credentials, roles,
                               endpoints, functions) shared across all testers

Scope control:

Use --scope to limit testing to specific domains. CyberStrike automatically derives the registered domain (e.g. --scope api.example.com covers api.example.com but not other.com). Pass multiple --scope flags for multi-domain targets.

---

CyberStrike includes a full web interface. Run cyberstrike web and control your agents, MCP servers, Bolt connections, and vulnerability findings from any browser.

Access from anywhere with Cloudflare Tunnel:

Browser ──HTTPS──▶ Cloudflare Tunnel ──encrypted──▶ cloudflared (localhost) ──▶ CyberStrike Server



export CYBERSTRIKE_SERVER_PASSWORD=your-secure-password
cyberstrike web
# In another terminal:
cloudflared tunnel --url http://localhost:4096 run your-tunnel

Why this is secure:

• Zero open ports — CyberStrike binds to localhost:4096. cloudflared makes an outbound-only connection to Cloudflare's edge. No firewall rules, no port forwarding needed.
• End-to-end encryption — Browser to Cloudflare edge is TLS. Cloudflare edge to your machine is an encrypted tunnel. No plaintext leaves your network.
• Password-protected API — Every API request requires Basic Auth. Local requests on localhost bypass auth for convenience; remote requests via CF tunnel always require credentials (detects X-Forwarded-For / CF-Connecting-IP).
• Your data stays local — LLM inference runs on your hardware. CyberStrike processes everything locally. The tunnel is just a secure pipe.

What's in the Web UI:

Tab	What It Does
Chat	Full conversation with all 13+ security agents
MCP	Live MCP server status, health, and tool counts
Bolt	Bolt remote server connection monitoring
Vulnerabilities	Discovered vulns with severity, PoC, and impact
Web Context	Endpoints, roles, credentials, and functions discovered during active sessions

app.cyberstrike.io is a hosted static page (no backend, no data storage) for convenience. Or self-host: clone the repo and serve packages/app/dist/ from your own domain.

---

Bolt — Remote Tool Execution

Bolt is CyberStrike's remote tool server. Deploy it on any VPS, cloud instance, or Docker container — then control it from your local terminal over MCP protocol with Ed25519 authentication.

One CyberStrike, many Bolt servers:

                                          ┌─────────────────────┐
                                     ┌───►│  Bolt Server #1     │
                                     │    │  nmap, nuclei, ffuf  │
┌──────────────────┐   MCP + Ed25519 │    └─────────────────────┘
│  Your Terminal   │   over HTTPS    │    ┌─────────────────────┐
│  CyberStrike TUI │ ◄─────────────►├───►│  Bolt Server #2     │
│                  │   Tool Results   │    │  sqlmap, burp, zap   │
└──────────────────┘                 │    └─────────────────────┘
                                     │    ┌─────────────────────┐
                                     └───►│  Bolt Server #3     │
                                          │  Custom toolkit      │
                                          └─────────────────────┘

• Deploy anywhere — VPS, Docker, Kubernetes, or bare metal with pre-built Kali images
• Ed25519 key pairing — No passwords, no shared secrets, no attack surface
• Real-time streaming — Results flow back to your TUI as they happen
• Manage from TUI — Add, remove, and monitor Bolt servers without leaving CyberStrike
• Scale horizontally — Run heavy scans from servers with better bandwidth while you work locally

---

CyberStrike connects to specialized MCP servers that extend its capabilities — 176+ security tools across 5 domains:

Server	Tools	What It Adds
cloud-audit-mcp	38	Cloud security audits — 60+ checks across AWS, Azure, GCP
github-security-mcp	39	GitHub security posture — repo, org, actions, secrets, supply chain
cve-mcp	23	CVE intelligence — NVD, EPSS, CISA KEV, GitHub Advisory, OSV
osint-mcp	37	OSINT recon — Shodan, VirusTotal, SecurityTrails, Censys, DNS, WHOIS

All open source. All installable with npx. Plug them into CyberStrike or use them standalone with any MCP-compatible client.

---

CyberStrike agents have direct access to 56+ tools without any external dependencies:

Category	Tools
Execution	Shell (bash), file read/write/edit/patch, directory listing, batch operations
Discovery	Web fetch, web search, code search, glob, grep, intel gathering
Offensive	HackBrowser, attack script execution, vulnerability reporting & triage
Post-Exploitation	AWS hook, Azure hook, Kubernetes hook, Windows hook, macOS hook, CI/CD pipe, eBPF
Web Context	Session context, endpoint/role/credential/function discovery and management
Proxy	HTTP/HTTPS interception, request replay, session context sharing across sub-testers
Reporting	Professional report generation, coverage notes, methodology tracking, VRT checks
Integration	MCP servers, Bolt remote tools, custom plugins, LSP

Plus a plugin SDK with 15+ hook types (tool interception, message transformation, permission prompts, shell environment) — build your own agents and tools, register them at runtime.

---

CyberStrike includes built-in post-exploitation capabilities across multiple platforms — no external tools required.

Platform	Capabilities
macOS	Chrome credential extraction, Keychain dumping, keylogging, TCC bypass, GateKeeper bypass, XProtect checks, SSH key extraction, DTrace system tracing
Windows	Post-exploitation hooks for privilege escalation and persistence
Linux/eBPF	29 kernel-level scripts — process execution monitoring, SSL/TLS sniffing, keystroke logging, namespace manipulation detection, rootkit detection, process/file/connection hiding
AWS	IAM enumeration, S3 exposure, Lambda backdoors, CloudTrail evasion
Azure	Identity enumeration, storage exposure, function exploitation
Kubernetes	Pod escape, service account abuse, secret extraction, RBAC exploitation
CI/CD	Pipeline injection, secret extraction, build artifact manipulation

All post-exploitation tools are agent-driven — they execute based on context and findings, not as fixed scripts.

---

# npm (recommended)
npm i -g @cyberstrike-io/cyberstrike@latest

# bun / pnpm / yarn
bun add -g @cyberstrike-io/cyberstrike@latest

# macOS (Homebrew)
brew install CyberStrikeus/tap/cyberstrike

# Windows (Scoop)
scoop install cyberstrike

# Linux / macOS (curl)
curl -fsSL https://cyberstrike.io/install.sh | bash

---

• Pentesters — Automate the repetitive parts. Let agents handle recon and initial testing while you focus on the creative attack chains that need human intuition.
• Bug Bounty Hunters — Faster reconnaissance, wider coverage, consistent methodology across programs. CyberStrike doesn't get tired at 3am.
• Security Teams — Run structured OWASP assessments with reproducible methodology. Get reports that map to standards your compliance team understands.
• Security Researchers — Extend CyberStrike with custom agents and MCP servers. The plugin system and MCP protocol make it a platform, not just a tool.

---

CyberStrike is built by the security community, for the security community. We welcome contributions across:

• Security agents and skills — New attack methodologies, testing patterns, vulnerability detection
• MCP servers — Connect new security tools and data sources
• Knowledge base — WSTG, MASTG, PTES, CIS methodology guides
• Core improvements — Performance, UX, provider integrations, bug fixes

Read the Contributing Guide before submitting a PR. All contributions must follow the project's ethical use policy — CyberStrike is for authorized security testing only.

---

AGPL-3.0-only — Free for personal and open-source use. Commercial licensing available via contact@cyberstrike.io.

---

CyberStrike is the core platform. These MCP servers extend its capabilities:

Project	Domain	Tools
CyberStrike	Autonomous offensive security agent	13+ agents, 56+ tools, 7,600+ skills, 150+ AI providers
cloud-audit-mcp	Cloud security (AWS/Azure/GCP)	38 tools, 60+ checks
github-security-mcp	GitHub security posture	39 tools, 45 checks
cve-mcp	Vulnerability intelligence	23 tools, 5 sources
osint-mcp	OSINT & reconnaissance	37 tools, 12 sources

---

cyberstrike.io · Docs · Discord · X.com · GitHub

Built by hackers who got tired of copy-pasting between terminals.